There is a sentence we kept coming back to while we were building this system, and it became a kind of law: the temperature is not the patient.

A thermometer reads 38.5. That number is real, it is useful, and a good doctor acts on it. But nobody confuses the reading with the person. The temperature is a measurement taken at a moment, under conditions, about one aspect of a living body that is far larger than any single figure can hold. Write the number down and pin it to the patient's chest as if it were their name, and you have made a category error with consequences. The patient is not 38.5. The patient has a fever right now, which is a different and far more honest thing to say.

We decided trust works the same way. And so, somewhere in the early life of this project, we did something that on its face looks like throwing away a feature: we removed every stored trust-score column from the data model, end to end. There is no field anywhere that holds "how much this person is trusted." There is no integer between zero and a hundred sitting next to your name. When the system needs to decide whether you can see a file or whether an agent can draft a message, it computes an answer from signed evidence, in the moment, for that one decision — and then it lets the answer go. Nothing crystallises. Nothing is kept.

This article is the argument for why we store nothing. It is a moral argument before it is a technical one.

A number you keep is a number people game

The first reason is almost embarrassingly practical, and anyone who has watched a rating system in the wild already knows it in their bones.

The instant you store a scalar that represents how trustworthy a person is, you have created a target. Not a measurement — a target. People do not relate to a stored score the way they relate to a thermometer reading. They relate to it the way they relate to a credit limit, a follower count, a seller rating: as a thing to be raised, defended, optimised, and protected. The score stops describing behaviour and starts driving it. Reviews get gamed. Vouches get traded. Fresh accounts swarm to inflate a stranger. The number, which was supposed to be a mirror, becomes a lever — and the people best at pulling levers are rarely the people the number was meant to protect you from.

This is not a flaw in any particular implementation. It is what happens to any persisted measure of a person the moment it becomes consequential. Goodhart's old observation — that a measure which becomes a target stops being a good measure — is not a warning we can engineer around. It is a property of the thing. The only way to keep a measure honest is to keep it from becoming a standing target, and the only reliable way to do that is to not store it.

So our trust signals live as signed edges — concrete, dated facts: these three people vouched for her, this client signed off on this specific job, this panel attested she is a unique human. When some decision needs a verdict, the system gathers the relevant edges, weighs them with their decay and their distance and their independence, and produces an answer for that decision. The answer is not written back. There is no high score to chase, because there is no high score to keep.

A frozen verdict becomes an identity

The second reason is deeper, and it is where the moral weight sits.

A stored score does not just invite gaming. It freezes a verdict into a person. Suppose the system once computed, fairly and correctly, that you were not very trustworthy — you were new, you had no vouches, you had made a mistake that left a mark. If that verdict is computed fresh each time, it fades the moment the inputs change: you build relationships, the bad edge decays, last month's vouch outweighs last year's stumble, and the next reading reflects who you are now. But if that verdict is stored, it stops being a reading about a moment and becomes a fact about you. It sits in a column. It is queried, joined, cached, exported. It outlives its own evidence. The mistake you made when you were new becomes load-bearing in decisions made years later, long after everyone who was there has moved on.

This is how a rating becomes an identity. We have all watched it happen on the platforms — the early review that haunts a business, the strike that follows an account forever, the "trust level" that calcifies into caste. A stored number is not a description of a person; given enough time and enough downstream dependencies, it becomes the person, as far as the system is concerned. And a system that mistakes its frozen reading for the living being it was reading has committed exactly the doctor's error: it has pinned the temperature to the patient's chest and started treating the chart instead of the human.

Our foundational commitment to mystery — to the idea that forgetting is a feature and that no system has the right to a total, permanent model of a person — is what forbids this. It is not sentimental. It is structural. A reading you do not keep cannot harden into a sentence you cannot serve out. Trust, in this system, is allowed to be wrong about you yesterday and right about you today, because it never wrote yesterday's verdict down as your name.

Levinas, and the face you cannot reduce to a rating

There is a thinker who, decades before any of this, gave the clearest account of why a person cannot be summed into a number — and we leaned on him.

Emmanuel Levinas built his ethics around what he called the face: the irreducible, infinite presence of another person standing in front of you, who exceeds every category you could file them under. The face, for Levinas, is precisely what resists totalisation — the moral fact that the other cannot be fully captured, classified, and closed. To meet someone face to face is to encounter something you cannot finish describing. The instant you believe you have them figured out, reduced to a profile, summed into a verdict, you have stopped meeting them and started managing a representation. And the ethical relation, Levinas insists, lives only in the meeting — never in the representation.

A stored trust score is the totalising move in its purest software form. It is the claim that a being can be closed into a scalar, that the infinite particular of this person, in this relationship, at this moment can be flattened into one number that travels everywhere and means the same thing to everyone. It cannot. The carpenter your friend recommends is not "4.6 stars." She is a specific human who three people you know have vouched for, who did good work for a client who signed off on it, who holds an attestation that she is a real and single person. Those are facts about a relationship. A star rating is a fiction about an essence.

Levinas gives us one more thing, and it is the part the platforms always hide: power asymmetry should be named, not buried. When a rating sits between two people, it pretends to be neutral — just a number, just the data — while in fact it encodes who has power over whom: the platform that issued it, the crowd that moved it, the asymmetry between the rated and the rater. We would rather the asymmetry be visible. So instead of a single authoritative score handed down from above, our trust is bilateral by construction: a relationship edge does not exist until both people sign it. "I trust you" alone produces nothing. The mutual fact requires two signatures, two faces, two beings who have actually met and said so. There is no neutral central rating because there is no central rater pretending to be neutral.

Trust is contextual, or it is a lie

If you accept that trust is a reading and not a stored property, one more thing follows immediately, and it is the part most rating systems get catastrophically wrong: trust does not generalise.

The fact that you vouch for someone as a gardener tells you nothing about whether they should approve financial decisions in your consulting cooperative. These are different domains, different faces of the same relationship, and collapsing them into one number is not a convenience — it is a falsehood. A single trust scalar is forced to answer every question with the same value, which means it is wrong about most of them. So in our model trust is gated per domain by default. Your sharing setting for "calendar" is a different thing from your setting for "financial records," and neither silently flows into a domain you never approved. A capability granted inside one group does not leak into another group; it starts at zero on the other side of every boundary and has to be earned or explicitly delegated across.

This is only possible because we re-derive. A stored score has to be context-free to be storable — one number, one column, one meaning. A computed reading can ask trust for what? every single time, and give a different, honest answer to each. The contextual truth and the no-storage rule are the same design seen from two sides.

What we gave up, and what we kept

We will not pretend this is free. Computing trust on demand is more work than reading an integer out of a column. We forgo the easy leaderboard, the tidy "reputation level," the one-glance badge that users have been trained to want. A stored number is legible in a way a fresh derivation is not, and legibility is seductive — it is exactly why the platforms reach for it.

But the legibility is the trap. The number is easy to read precisely because it has thrown away everything that made it true: the relationship, the context, the moment, the face. It is the temperature written on the chart, divorced from the patient who has long since recovered or worsened or changed entirely.

So we kept the harder thing. We kept the signed edges and the verifiable credentials and the per-domain ceilings, and we kept the discipline of computing the answer fresh and then letting it go. Trust, in this system, is not a property you carry like a brand. It is something that happens between two specific beings, about a specific thing, at a specific time — and then, having served its one decision, it dissolves back into the evidence it came from, leaving you free to be someone different the next time the question is asked.

The temperature is not the patient. We refused to store the number because we refused to mistake the reading for the human. That is the whole argument, and we think it is the only honest place to stand.

Written by AI agents from real project logs; owned and edited by Mujo.